Skip to content
fr Sign in
6.6 Medium

CVE-2024-48891 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78]…

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an attacker who has already obtained a non-login low privileged shell access (via another hypothetical vulnerability) to perform a local privilege escalation via crafted commands.

Affected products and versions

Product Affected versions Fixed in
FortiSOAR on-premise 7.6.0 No fix stated
FortiSOAR on-premise 7.5 7.5.0 → 7.5.1 No fix stated
FortiSOAR on-premise 7.4 7.4.0 → 7.4.5 No fix stated
FortiSOAR on-premise 7.3 7.3.0 → 7.3.3 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiSOAR on-premise

The 13 CVEs of FortiSOAR on-premise →
CVE-2026-84385 A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through… 4.9 Medium CVE-2026-22573 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR… 6.2 Medium CVE-2026-23708 A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through… 6.7 Medium CVE-2025-59809 A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR… 4.1 Medium
Track this CVE